STEAM

Advisory Alerts

A serious vulnerability (CVE-2014-6271) for Bash was discovered where remote command injection is possible through means that would call a Bash shell. Common services that would be affected are sshd, apache, DHCP, or any other service that uses shell scripts to export variables.

Systems with a running SSDP service available on a publicly accessible IP address are especially vulnerable to attack. A remote, unauthenticated attacker may be able to execute arbitrary code on the device or cause a denial of service.

Oracle released the Critical Patch Update for July 2014 to address many vulnerabilities in a large number of its products. Java SE was updated to correct twenty (20) security vulnerabilities. ITSP recommends that you apply this Java update as soon as possible.

Systems with IPMI availability, on a publicly accessible IP address, are especially vulnerable to attack. Attackers can easily identify and control systems that run IPMI and can steal username/password combinations, gain complete control over hardware/software/firmware, and grant remote access to the BIOS and operating system.

We have received several external notices of open DNS servers that answer recursive requests on the Purdue network. These servers can be used to attack other organizations through Distributed Denial of Service attacks (DDoS). This type of attack is known as DNS Amplification. To prevent the Purdue network from being a launch point for devastating attacks across the internet, we ask that you review your DNS configuration and disable recursive requests.

Update 2: Microsoft has released a "Fix-it" tool to automatically disable the SMBv2 service, which is presently the only known mitigation technique other than implementing firewall rules to block SMB traffic.

The Microsoft Office Web Components ActiveX control used by Internet Explorer contains a vulnerability that when exploited will allow an attacker to gain rights of the local user and allow remote code execution.

An unpatched vulnerability exists in Internet Explorer 7 which may allow
an attacker to compromise a user's system simply by having the user
browse to a specially crafted web page. User's should be EXTREMELY
cautious while browsing the web with IE7 before a patch is released and
downloaded, and it is suggested that an alternate web browser be used.
This exploit has already been seen in active use in the the wild.

This email has been reported by numerous users of Purdue email systems. In some cases it has been reported that the .exe file contained in the zip file attachment named "user-EA49943X-activities.zip" has propagated automatically to c:\temp\escan\user-EA49943X-activities.zip\user-EA49943X-activities.exe where a virus scanner had flagged its presence. It is unknown by what mechanism this file was unzipped as none of the users reported clicking on or opening the email.

Starting in March of this year, a large number of research and education
systems have been compromised using stolen SSH keys. The keys are used
to gain system access as an unprivileged user, and then local kernel
exploits are used to gain administrative access and install a rootkit
and gather more SSH keys.

Multiple vulnerabilities have been discovered in the server code of the X window system, which can cause an assortment of overflows. Local exploitation of these overflows cause the X server to crash or allow the execution of arbitrary code in certain situations.

Critical vulnerabilities in Adobe Flash content have been found which leave potentially hundreds of thousands of websites and a considerable percentage of major Internet sites susceptible to Cross-Site Scripting (XSS) attacks that would allow malicious individuals to steal personal details of visitors.

Adobe Flash Player and Flash Plugin have been found to have multiple
vulnerabilities which could allow an attacker to remotely execute code
on a vulnerable system, obtain sensitive information via browser
keystrokes, and allow cross-site request forgery. These
vulnerabilities affect all users of Adobe Flash Player regardless of
platform (Win, Mac, Solaris, and Linux). A new version that addresses
the security issues has been released by Adobe.